Process GDPR Request

Endpoint	Method
/api/admin/customers/gdpr-requests/{id}/process	POST

Destructive action

For type=delete requests this cascades the customer deletion (fires customer.delete.before/after so the GDPR module's listeners run). For type=update requests it only marks the request approved — admin then applies the requested edits through the regular Customer update endpoint.

Idempotency by rejection

Already-approved or revoked requests are refused with 422.

Permission: customers.gdpr_requests.edit.